Investigate Unauthorized Changes in the Azure Activity Log

Learn how to investigate an unapproved website change with the Azure CLI. The progress site shows a version three preview, but the latest approved release is version two. Use Azure CLI commands to compare the site files, examine role-assignment events in the Azure Activity Log, and review access to the storage account. Match the principal IDs to the team roster, identify who could change the site, and collect the publisher's notes as proof. This lab shows how the Activity Log records management events but not Blob Storage data actions. You will combine activity events, Azure role assignments, and storage evidence to identify the publisher.